safety-risk-management

7/30/2019 safety-risk-management

1/28

Safety Management Systems i

3SMS for AviAtionA PrActicAl GuideSaety RiSk ManageMent


2/28

Safety Risk Management

cs

What s safet rs manaement? 01

identfn safet hazards 01

Rs assessment and mtaton 05

ALARP 09

Case stud fatue rs manaement 12

Toolt Safet rs manaement 17

2012 Civil Aviation Saety AuthorityFor urther inormation visit www.casa.gov.au

This work is copyright. You may download, display, print and reproduce this material in unaltered orm only (retaining this notice) or your personal, non-commercial useor use within your organisation. Apart rom any use as permitted under the Copyright Act 1968, all other rights are reserved. Requests or urther authorisation should bedirected to: Saety Promotion, Civil Aviation Saety Authority, GPO Box 2005 Canberra ACT 2601, or email [email protected]

This kit is or inormation purposes only. It should not be used as the sole source o inormation and should be used in the context o other authoritative sources.The case studies eaturing Bush Air and Bush Maintenance Services are entirely fctitious. Any resemblance to actual organisations and/or persons is purely coincidental.

1105.1511


3/28

Safety Management Systems 01

Wha s say smaagm?

Saety risk management: the identication,

analysis and elimination (and/or mitigation to an

acceptable or tolerable level) o the hazards, as

well as the subsequent risks, that threaten theviability o an organisation. (ICAO Doc. 9859)

Beore an SMS can be eectively built or

improved, you must identiy the saety hazards

to your operation and ensure you have controls

in place to manage risk. An SMS should be

risk based. For example, the risks involved in

operating helicopters regularly at low level are

quite dierent to those o an RPT service, so

each operators SMS will need to refect that.

Saety risk management is a careul examination

o what, in your work, could cause harm, so

that you can weigh up whether you have taken

enough precautions, or should do more to

prevent harm.

History shows that aircrat accidents not only

ruin lives, but also aect business i output

is lost, assets or equipment are damaged,

insurance costs increase, or you have to go to

court. Legally, you must assess the risks to sae

operations in your workplace, and implement a

plan to control those risks.

Saety risk management is a key component o

an SMS and involves two undamental saety-

related activities:

1. Identiying saety hazards

2. Assessing the risks and mitigating them

(reducing the potential o those risks to

cause harm).

iyg say hazas

A hazardis anything that could cause

harm, damage or injury, or have a negative

consequence, such as bad weather, mountainous

terrain, FOD, lack o emergency equipment,

high workload/atigue or use o alcohol and

other drugs.

There are many ways o identiying hazards and

quantiying risks, but to do it successully you

have to think laterally, unencumbered by past

ideas and experiences. Operational hazards can

be obvious, such as lack o training, or they may

be subtle, such as the insidious eects o long-

term atigue.

thr r svrl usul mhods o

d hzrds:

Brainstorming - small discussion groups meet

to generate ideas in a non-judgmental way

Formal review o standards, procedures

and systems

Sta surveys or questionnaires

One person standing back rom the operation

and monitoring it critically and objectively

Internal or external saety assessments

Hazard reporting systems.

Hazard identication generally involves

three steps:

1. Stating the generic hazard (hazard statement)

e.g. atigue/high workload, bad weather

2. Identiying specic components o the

hazard e.g. errors because o atigue

3. Identiying project-specic risk/s associated

with each hazard e.g. maintenance errors

resulting rom atigue, especially at times

o Circadian low (2am-6am), CFIT, uel

exhaustion because o bad weather.


4/28

02 Safety Risk Management

I you are a small aviation organisation with only

a ew sta, you simply need to apply discipline

and make the time to examine all acets o your

operations and identiy their hazards. You need to

either eliminate the hazards where possible, vary

the operation, or redesign in a practical way to

protect rom the hazards. You need to be able to

be satised that all risks are acceptable.

For larger organisations, setting up discussion

groups with as many sta and line managers as

possible is a good way o identiying hazards. The

group discussions will also encourage sta to

become more actively involved in establishing or

improving your SMS.

To avoid accidents and incidents any organisation

should have multiple layers o controls or

deences in place. However, controls are neveroolproo or example, having well-trained

maintenance engineers does not ensure that

aircrat components are always tted correctly,

and standard operating procedures or fight crew

are only as eective as those who ollow them.

Regularly identiy what deences you have

against recognised saety hazards.

Step 1: identf safet hazards

Focus group discussions should ask participants

to brainstorm the types o saety hazards they

think may threaten the saety o passengers,

employees or contractors. The group should also

consider those hazards which could damage

equipment, or harm the environment. Forexample, or fight crew, uel exhaustion would

be a hazard that could result in the loss o both

an aircrat and its passengers. For maintenance

engineers, atigue might be a hazard during night

shit operations.

There may also be systemic hazards

organisational actors that could result in

the loss o an aircrat, or injury to or the death

o passengers. These hazards include:

insucient training; lack o policies orprocedures; and people not ollowing these

policies or procedures.

Step 2: Ran and assess the severt ofthe safet hazards

Assess the hazards critically. Factors to consider

are the likelihood (how oten the hazard might

result in a saety occurrence), and the severity

(how bad the outcome would be) o any

consequences. For example, a serious in-fight

re might be an unlikely occurrence, but it would

be catastrophic i it were to occur. It would rank

above a bird strike which, although much more

likely to occur, tends to be less severe. Keep the

process simple and get global views about how

signicant an issue the hazard really is, in the

context o all the hazards identied.

Step 3: identf the controls/defences

n place to manae the hazardsOnce you list the hazards and rank their order

o risk, you should identiy possible deences

(hazard controls) against them. One deence

against an in-fight re is a re extinguisher; a

deence against aircrat uel contamination is

correct uel ltration procedures and regular uel

testing. This step should provide a list o current

controls/deences against each hazard: some

controls will deend against multiple hazards.

Sx smpl sps r susd s

rl wr s ssm:

1. Identiy saety hazards across your

operations that could harm people,

equipment, property or the environment.

2. Rank the likelihood and severity o

these hazards

3. Identiy the current deences/controls

in place to manage them

4. Evaluate the eectiveness o each

deence/control

5. Identiy additional deences/controls

where required

6. Record/(and continue to monitor) all this

inormation in a hazard register.


5/28


Step 4: Assess the eectiveness of thecurrent controls/defences

How eective is each hazard control/deence?

Would the control prevent the occurrence (i.e.

does it remove the hazard?), or just minimise

the likelihood or the consequence? You can

determine how eective a hazard control isby asking, or example: Does the crew know

how to use the re extinguishers, and are the

extinguishers correctly maintained? You will then

have a list o eective controls, as well as a list o

which controls need improvement.

Step 5: identf further controls/defences requred

Examine each hazard and its control/s to

determine whether the risk is adequately

managed or controlled. I it is, the operation

can continue. I not, consider how to improve

the hazard control, or to remove or avoid thehazard entirely. For example, you could provide

recurrent training or crew in the correct use o

re extinguishers.

You should manage the risk to a point o

ALARPas low as reasonably practicable. You

should consider/apply all possible means o

mitigation until the cost o mitigation is grossly

disproportionate to the benet you obtain.

In some instances, there could be a range osolutions to manage a risk. Typically, some are

engineering solutions (e.g. redesign), which,

although probably the most eective, may

also be expensive. Others involve control (e.g.

operating procedures) and personnel (e.g.

training) and might be less costly. The solution

need not be costly to be eective.

Bush Maintenance Services has a close call

involving engine cowl asteners. Trevor Brown,

the saety ocer and senior LAME, hears

rom the apprentice, Ryan Johnson, that an

aircrat went out with the asteners missing.

The other LAME, Geo White, was due to

nish the service on his shit, but had ooty

practice or the nals that weekend, and let

in a rush, saying over his shoulder as he raced

out o the hangar, Mate, shes all done. Just

give her a wipe-over; the doc will be here in

the morning. Ryan had done double shits

16 hours straightand had to have the

Beechcrat nished or the local doctor to fy

to the city in the morning. During the graveyard

shit, he wipes away an oil leak on the

hydraulics, but bone tired, does not notice

the missing asteners.

When the GP arrives in the morning, he

discovers the missing asteners on his walk-

around, and is understandably unimpressed.

I you cant get this right, what else have

you missed? he asks pointedly.

Bruce Jones calls a toolbox meeting. There

are things that stand between us and an

accident. Weve got to make sure theyreworking properly. How do we learn rom this,

and make sure it doesnt happen again? Bush

Air wont want us doing any more o their

maintenance, nor will Outback Exploration,

i we cant show more proessionalism.


6/28


Step 6: Record all ths nformaton n ahazard rester

This is important not only or your internal risk

management processes, but also in case you

ever need to provide inormation to CASA, the

ATSB or other regulators.

Ater completing these steps, you should have

the ollowing:

A list o saety hazards identied by

employees, ranked in order o importance

A list o current controls/deences in place to

manage these hazards

A list o urther controls/deences required to

improve saety across the operation

Sta involvement in identiying saetydeciencies and priority areas or improved risk

management

Who is going to do it.

Hazard identication checklist

SMS iteMS

Hazard

identication

processes

The organisation has established

various ways to proactively

identiy hazards through

discussion groups (condentialwhere possible in some

smaller organisations this may

be dicult or impossible),

reporting, or surveys.

The organisation uses the

database o reported hazards to:

- identiy hot spots needing

particular attention

- conduct trend analysis which

can help to improve hazard

identication.

Procedures are maintained

or the internal and external

reporting and recording o

hazards and other saety-related

issues to enable analysis and

organisational learning.

The organisation has processes

in place to ensure identied

hazards are dealt with in a timely

manner, and the results o any

actions are ed back to sta.


7/28


rs assssm a mga

The term riskreers to the chance that somebody

could be harmed by various hazards, together

with an indication o how serious the harm

could be.

Risk management is an integral componento saety management and involves ve

essential steps:

exmpl: One o the saety concerns or

air transport operators is incorrect loading o

passengers or reight on the aircrat, which can

lead to accidents.

safet rs manaement

Equipment, procedures,

organisation, e.g.

Hazard

identication

Analyse the likelihood o the

consequence occurring

Risk analysis

probability

Evaluate the seriousness

o the consequence i it

does occur

Risk analysis

severity

Is the assessed risk/s

acceptable and within

the organisations saety

perormance criteria?

Risk assessment

and tolerability

Yes,

accept

the risk/s

No, take action

to reduce the

risk/s to an

acceptable level

Risk control/

mitigation

I you work in, or run a larger organisation, you

can ask an advisor to help you. I you are not

condent, ask someone competent or advice.

In all cases, you should make sure that you

involve your sta or their representatives in the

process. They will have useul inormation about

how the work is done that will make your risk

assessments more thorough and eective.

Step 1: identf the hazards

Work out how sae operations could be harmed.

The hazard identication methods already

mentioned are a good start. However, when you

are in your workplace day ater day, it is easy to

overlook hazards, so here are some tips to help

you identiy the ones that matter:

Walk around your workplace looking or thingsthat could reasonably be expected to cause

harm. Involve your employees: they may have

noticed things that are not immediately obvious

to you.

Review your accident recordsthey can oten

help to identiy less-obvious hazards.

Review previous saety occurrences and

maintenance errors. These will help in

understanding risks and their potentiallikelihood and consequences.

Review CASA or ATSB reports.

Ask similar organisations what they ound and

have done about it.

Do ovrcomplc h procss. You should

already have a good idea o the risks and o any

control measures that you can easily apply. You

probably already know whether, or example, you

have employees who commute a long distanceto work areas, or areas o maintenance which

are more prone to risk. I so, check that you have

taken reasonable precautions to avoid incidents.

I you run a small organisation and are condent

you understand whats involved, you can do the

assessment yoursel. You do not have to be a

risk specialist.


8/28


Step 2: Decde what mht be harmedand how the harm mht be caused

For each hazard you need to be clear about what

might cause harm. This will then help you identiy

the best way to manage the risk. That doesnt

mean listing everyone by name, but rather

identiying groups o people (e.g. fight crew,cabin crew and passengers).

In each case, you should identiy what might

occur. You will also need to identiy the possible

reasons (root causes) o the hazard.

An online search or SMS sotware will provide

numerous potential suppliers o aordable

sotware to manage all this.

Wh?

Incorrect aircrat loading can aect the saety

o fight crew, cabin crew, passengers on board

and people on the ground.

Cuss?

Incorrect aircrat loading can result rom:

Poor weight and balance calculations

Failure to weigh baggage correctly

Miscommunication between fight crew

and aircrat loading sta

Failure to secure reight properly

Loading o the wrong baggage/reight on

the fight

Inormation entered incorrectly into the

fight management system.

Identication of the severity/consequence of the event

Take into account any current mitigation measures and assess the severity in terms o the worst

possible realistic scenario.

Lvl Svr/

Cosquc

Dscrpor

5 Severe Catastrophic (at least one atality, huge nancial loss)4 Major Major (extensive injuries to one or more people, major nancial loss

3 Moderate Moderate (medical treatment required, high nancial loss)

2 Minor Minor (rst aid treatment at the workplace, medium nancial loss)

1 Negligible Insignicant (no injuries, low nancial loss)

Lelhood of occurrence

Take into account any current mitigation measures and assess the likelihood/probability o the risk

occurring.

Lvl Llhood Dscrpor

5 Almost certain Imminentis expected to occur in most circumstances

4 Likely Once in the next month, will probably occur in most circumstances

3 Possible Once in the next 12 months, might occur at some time

2 Unlikely Once in the next 15 years, could occur at some time

1 Rare Once in the next 10 yearsmay occur only in exceptional

circumstances

The saety manager/ocer will enter the results into the saety report and hazard log.


9/28


practice and see i there is more you should

be doing to bring yoursel up to standard.

Ask yoursel:

Can I eliminate the hazard altogether?

I not, how can I control the risks so that

harm is unlikely?

Can I try a less risky option? Prevent access to

the hazard? Reduce exposure to the hazard?

Improving saety need not cost an enormous

amount. For instance, placing a mirror on a

dangerous blind corner o the airport apron to

help prevent vehicle accidents is a low-cost

precaution, considering the risks. Failure to take

simple precautions can be much more costly i

an accident does happen.

evlu rs lvl An important task inanalysing risk is to determine the risk level based

on its likelihoodand consequence.

Likelihood consists o two parts:

The likelihood o a single event occurring

The likelihood o the event occurring based

on exposure and repetition (how oten the

task is perormed, such as cycles o aircrat

maintenance etc.)

A simple way to determine the likelihoodis to

rank the hazard based on its potential requency

o ocurrence. This can be done on a simple ve-

point scale, rom rare to almost certain.

Consequenceis the potential impact or outcome

that may result rom the hazard. This can range

rom insignicant to catastrophic.

Use the risk tolerability matrix to assess how

tolerable the risk is using the results obtained

rom the assessment o the consequences

and likelihood.

Cosquc

1 2 3 4 5

Negligible

Minor

Moderate

Major

Severe

Likelihood 5 Almost certain 6 7 8 9 10

4 Likely 5 6 7 8 9

3 Possible 4 5 6 7 8

2 Unlikely 3 4 5 6 7

1 Rare 2 3 4 5 6

> 7 exrm

rs

Detailed treatment plan

required

6 to 7 Hh rs Needs senior

management attention

and treatment plan as

appropriate

4 to 5 Mdum

rs

Manager-level attention

and monitoring as

appropriate< 4 Low rs Manage by local-level

procedures

The saety manager/saety ocer will enter the

results into the hazard register

arcr lod s rulr cv,

so h likelihoodo corrc lodo h wro hold s ssssds possbl d h potentialconsequencec b modr,rsul corrc lodb corsd s hh, vh pol or dm o rcrsrucur, or h rcr b ou owh d blc olrcs.

Step 3: Evaluate the rss

Having identied the hazards, you then have to

decide what to do about them. You must do

everything reasonably practicable to mitigate the

risks o identied hazards. You can work this out

or yoursel, but the easiest way is to compare

what you are doing with good practice and/or

with what your competitors are doing.

Examine what you are already doing. Think about

what controls you have in place and how the

work is organised. Then compare this with good


10/28


I, as in many organisations, you nd that there

are a number o improvements to be made,

both large and small, do not try to do everything

at once. Make a plan o action to deal with

the most signicant risks rst. CASA inspectors

acknowledge the eorts o aviation organisations

that are clearly trying to make improvements.

However, you cannot continue operations i a

risk is assessed as intolerable, until that risk is

mitigated to acceptable level.

You need to allocate tasks to the right people,

with timelines or getting the job done. One large

successul operator makes sure things are done

by having the CEO as the only person who can

approve extensions. There must be a very good

reason or any extension request.

A good plan o action oten includes a mixture

o dierent things. There may be a ew cost-

eective or easy improvements you can do

quickly, perhaps as a temporary solution until

more reliable controls are in place. Remember

to prioritise and tackle the most important

things rst. As you complete each action, tick it

o your plan.

While the majority o saety deences/controls

in place were assessed as eective, additional

measures are required, which are detailed in

a risk management plan outlining short-and

longer-term measures:

Shor-rm

Extra nets and straps to be made available

to secure cargo correctly

Standard load sheet to be held in the cockpit

at all times.

Lo-rm

Standard training or all people involved in

baggage handling.

Dcd o prcuos Once you determine

the risk levels, assess the saety deences or

controls in place to work out how eective they

are against the hazard or hazardous event.

Step 4: Record your ndings andmplement them

Having assessed the risk and the deences

in place, decide how to implement your risk

management plans. You may avoid the risk,

accept the risk in order to pursue an opportunity,

remove the risk, or share the risk with another

party (see ISO 31000:2009).

Putting the results o your risk assessment into

practice will make a dierence when looking

ater people and your business.

Record the results o your risk assessment and

share them with your sta. It is important to

document what you have done so that you can

review it at a later date i anything changes.

A risk assessment does not have to be perect,

but it must be suitable and sucient. You need

to be able to show that:

you made a proper check

you asked who might be aected

you dealt with all the signicant hazards, taking

into account the number o people who could

be involved

your precautions are reasonable and any

residual risk is low

you involved your sta, or their

representatives, in the process.

Saety deences/controls in place to prevent

incorrect aircrat loading:

Standard industry weights used or

passengers

Securing cargo more eectively

Cargo and baggage weighed separately

Standard load sheet used by pilots to

calculate weight and centre o gravity

o the aircrat

Correctly calibrated scales


11/28


Step 5: Monitor the eectiveness ofour mplementaton

Monitor your agreed implementation solutions

to make sure they are working, and i they are

not, reassess.

Step 6: Revew our assessment andupdate f necessar

Few workplaces stay the same. Sooner or later,

you will bring in new equipment and procedures

which could lead to new hazards. It makes

sense, thereore, to review what you are doing

regularly. As a minimum, once a year you should

review where you are, to make sure you are still

improving, or at least not sliding back.

Review your risk assessment. Have there been

any changes? Are there improvements youstill need to make? Have your workers spotted

a problem? Have you learnt anything rom

accidents or near misses? Make sure your risk

assessment stays up to date.

When you are running a business it is all too easy

to orget about reviewing your risk assessment,

until something goes wrong and it is too late.

S rvw d or hs rsssssm. Wr dow d o

our dr s ul v, or r our ol cldr.

During the year, i there is a signicant change,

dont wait. Check your risk assessment and,

where necessary, amend it. I possible, think

about the risk assessment when you are planning

the change that way you can be more fexible

and proactive.

AlArP*

Where risk is concerned, there is no such thing

as absolute saety. Risk management is oten

based on the concept o ALARP or as low as

reasonably practicable. There is wide acceptance

that not all risk can be eliminated. There are

practical limits to how ar the industry and

the community will go in paying to reduce

adverse risks.

The concept o ALARP will be replaced by

ALoS (acceptable level o saety) in the very

near uture.

th aLaRP prcpl d cos-bf lss

All eorts should be made to reduce risks

to the lowest level possible until a point is

reached at which the cost o introducing

urther saety measures signicantly

outweighs the saety benet.

A risk should be tolerated only i it can be

demonstrated that there is a clear benet in

doing so (i.e. there is a compelling operational

need in the organisation).

The ALARP principle identies three categories

o risk:

1. Uccpbl Risks are classied as

unacceptable regardless o the benets

associated with the activity. An unacceptable

risk must be eliminated or reduced so that

it alls into one o the other two categories,

or there must be exceptional reasons or the

activity or practice to continue.

2. tolrbl Risks that people are generally

prepared to tolerate to secure their benets.

Tolerable risks must be properly assessed and

controlled to keep the residual risk ALARP,

and must be reviewed periodically to ensure

they remain that way (e.g. the potential

risk o pedestrians, walking between the

terminal and the aircrat, being struck by a

moving vehicle is only tolerated IF appropriate

barricading, security escort and lighting are

in place).

Monitoring process documented:

Internal audit conducted every six monthson aircrat loading procedures

Date or an independent annual audit noted

in diary

Sta to be reminded ormally at least twice

in scheduled monthly saety briengs about

the saety reporting process in place to

report aircrat loading issues

Results o reports communicated to sta

through company education program.

* the concept o ALARP will be replaced by ALoS (acceptable level o

saety) in the very near uture


12/28


3. Brodl ccpbl Risks are considered

suciently low and well controlled. Further

risk reduction is required only i reasonably

practicable measures are available. Broadly

acceptable risks are those that people would

regard as insignicant or trivial in their daily

lives, or which exist, but have no practicable

mitigator (e.g. most organisations accept that

sta could be injured on their way to work,

but have little control over what happens on

public roads).

To determine whether a risk is tolerable

(in the ALARP approach), you need to consider

a number o criteria:

Ll rqurms Aviation organisationsmust comply with applicable CASA and

relevant state-based legislation. A control

based on a legal requirement must always

be considered reasonably practicable.

expr judm A proposed control should

be considered reasonably practicable i an

appropriate group o experts has established

it has a clear saety benet, and the costs

associated with its introduction are considered

reasonable.

Cos-bf lss Where expert

judgement or contemporary good practice

does not provide clear evidence that a specic

control or group o controls are reasonably

practicable, a cost-benet analysis may be

necessary. This establishes whether the cost

o implementing a specic control is grossly

disproportionate to its saety benet.

idusr ood prcc I the proposed control

represents current, relevant, established good

practice, that is sucient evidence to conclude

that it is reasonably practicable. For example, it:

- complies with aviation industry standards,

rules or procedures

- is a practice o other operators that aresimilar in scale and operation to your own

- is established and widely implemented in

another industry sector

- matches other countries legislated

enorcement o the practice

- is proven to have demonstrably improved

saety, or can be implemented without

signicant modication or cost.

Unacceptable regionRisk cannot be justied unless

in extraordinary circumstances

Risk is tolerable only i:

Further risk reduction is impracticable

or i its cost is grossly disproportionate

to the improvement gained,

Society desires the benet o the

activity, given the associated risk

Level o residual risk regarded as

negligible and urther measures to

reduce risk not usually required.

No need or detailed working to

demonstrate ALARP

nlbl rs

Tolerable region

Increasin

gindividualrisks

andsocie

talconcerns

The ALARP approach

Broadly

acceptable

region


13/28


ALARP applcaton

1. idfco o hzrd

A small certied aerodrome operator, located

in outback Australia, identies a saety hazard

wildlie wandering on to the runway, and

potentially colliding with aircrat.

Hazard = wildlie on runway, specifcally

wallabies, eral camels and donkeys.

2. Dcd who should b volvd h

ssssm procss

Aircrat operations during taxiing, take-o

and landing are exposed to this hazard.

The hazard is caused by inconsistent wildlie

management, seasonal conditions and the

absence o a perimeter ence.

3. evlu h rss d dcd o

prcuos

Discussions with aircrat operators and other

stakeholders using the aerodrome reveal no

identied incidents involving wildlie have

resulted in a collision. However, over the

last six months there have been ve

near-miss reports, two o which involved

minor evasive action (braking by the pilotin command) to avoid collision. The risk

is assessed as moderate, based on a

combination o possible (likelihood) and

minor (consequence).

The aerodrome operator decides that two

controls could manage the risk: an improved

wildlie management program, including

possible seasonal eradication o animals; and

constructing an aireld perimeter ence to

prevent wildlie access.

The airport operator decides the airport

perimeter ence is the most eective control

o the two available, and applies ALARP to

determine i this is justiable. They consider

the ollowing to determine whether the risks

are tolerable:

Legal requirementsThis is a certied

aerodrome under CASR Part 139, with

only one weekly RPT service and a variety

o charter and general aviation operations.

Thereore, there is no explicit aviation regulatory

requirement or a perimeter ence.

Expert judgementStakeholders consulted about

the possible construction o a ence agree that

it is an eective control, but the ence must bemaintained and inspected regularly.

Cost beneft analysisThe cost o the perimeter

ence construction and ongoing maintenance

program is determined to be beyond the

unds o the aerodrome operator, and local

government is unable to assist with nances.

The small number o incidents thereore

suggests that the cost is not justiable.

Industry practiceA quick survey o similar-

sized registered aerodromes suggests that not

all have perimeter ences, and some are only

partially enced. While perimeter encing is

recommended, industry practice suggests that

this is not consistent.

4. Rcord our fds d mplm

hm

The aerodrome operator decides thereore that

a perimeter ence is not justied, based on its

cost to build, that such a ence is not consistentwith industry practice, and that there is a limited

risk o wildlie on the runway colliding with an

aircrat. However, to ensure that the risks are

acceptable based on ALARP principles, they

decide to improve wildlie management through

a more targeted seasonal wildlie management

program keeping the grass down to minimise

ood supplies and regular sweeps o the runway

to deter wildlie.

5. Rvw our ssssm d upd cssr

They review the wildlie management

program annually, with aerodrome users

reminded to report wildlie activity on or

near the aerodrome.

They also contact CASA or resources to assist

in wildlie identication and management, and

develop a wildlie hazard management plan.


14/28


cas sy ag smaagm

What s fatue?

Fatigue is an experience o physical and/or

psychological weariness.I you become atigued, the eect can be the

same as i you have consumed alcohol. Fatigue

can, or example, aect your ability to react

quickly to emergencies; communicate clearly

and determine the sae limits o your actions;

as well as your ability to operate productively.

Managing atigue is an important component o

saety management, given that it is a signicant

and preventable actor in transport incidents/

accidents. For example, 20-30 per cent o road

incidents and 5-15 per cent o all atal road

accidents involve driver atigue.

What causes fatue?

Both work-and non-work-related actors

aect atigue.

Work-related atigue actors:

The hours you have to work (and the impact

o these hours on the opportunity to sleep)

The timing and duration o breaks within shits

The work you do

Your work environment.

Non-work-related atigue actors:

Long commutes to and rom work

Sleep disorders aecting the quantity and/or

quality o your sleep recovery

Your amily and social responsibilities

Having a second job.

Rs mtaton checlst

SMS iteMS

Risk mitigation

processes

The organisation has

a ormal saety risk

management process

used to:

- identiy hazards

associated with the

organisations operations

- analyse and assess

the risks associated

with those hazards

- implement controls to

prevent uture accidents,

incidents or occurrences.

This saety risk

management process

meets the ollowing

risk management

requirements to:

- (a) communicate

and consult

- (b) establish the context

- (c) identiy risks

- (d) analyse risks

- (e) evaluate risks

- () treat/mitigate risks

- (g) monitor and review.

There is a ormal record

o each stage o the risk

management process,

including assumptions,

methods, data sources,

analysis, results and

reasons or decisions.


15/28


Consequences of fatue

General consequences can include:

Lapses in attention/concentration

Poor risk assessment, and incomplete

or inaccurate assessment o potential

consequences

Ineciency in production, on-time

perormance, resource use (e.g. uel),

and/or motivation

Impaired or delayed decision making

A higher likelihood o ocusing on the most

obvious data or stimuli, to the exclusion o

other equally important inormation.

The table below indicates the typical behavioural

symptoms o atigue. I an employee has

experienced three or more o the specied

symptoms in a 15-minute period they are likely

to be atigued.

Fatue manaement countermeasures

Counter measures to prevent atigue-related

errors are listed below:

Nappn

Generally, the longer the nap the greater its

recovery value. Naps should provide at least20 minutes o sleep, but no longer than two

hours, to be o the greatest benet.

Longer naps can lead to sleep inertia - the

groggy eeling you have when someone wakes

you up during a deep sleep. So, beore returning

to work ater such a nap, people should have

10-20 minutes o recovery to overcome the

eects o sleep inertia.

Behavoural smptoms of fatue

PHySiCaL SyMPtOMS MentaL SyMPtOMS eMOtiOnaL SyMPtOMS

Yawning

Heavy eyelids

Eye rubbing

Head drooping

Inappropriate or

unintentional napping

Falling asleep

Poor coordination

Diculty concentrating on the current

work task

Lapses in attention

Diculty remembering what you are

meant to be doing

Failure to communicate important

inormation to a colleague

Failure to anticipate events or actions

Unintentionally doing the wrong thing

(errors o commission)

Unintentionally ailing to do the right

thing (errors o omission)

More quiet or withdrawn

than normal

Lethargic or lacking

in energy

Lacking in motivation to

do the task well

Irritable or bad-tempered

behaviour with colleagues,

amily or riends


16/28


Small- to medium-sized air transport operators

do not currently need custom-built crew rest

acilities or napping on their aircrat. Consider

a simple but eective strategy used by one

helicopter charter operator:

nOte

Mc r pr moor

Look out or the ollowing symptoms that may

indicate you or your co-workers are atigued:

Communication that goes unanswered, orchecklists that go unchecked

Diminished motor skills writing that trails

o into nothing, poor concentration, impaired

driving skills

Obvious tiredness drooping head, eyes hal

closed or staring

Diminished vision diculty in ocusing

Slow reactions

Short-term memory problems unable to

remember inormation you have just been told

Channelled concentration xation on a single,

possibly unimportant issue, neglecting others,

and unable to maintain an overview o the job

Easily distracted by trivia or, at the other

extreme, xation on a single issue

Poor or clumsy handling o tools/operation

o equipment Increased mistakes making poor decisions,

or no decisions at all

Abnormal moods mood swings, depressed,

periodically elated and energetic, diminished

standards.

Nappn faclt

A Bankstown-based helicopter charter operator

recognises that ater long and demanding

operations, its aircrew get into their cars and

in some cases drive or up to two hours to get

home. To oset the risk o atigue, all aircrew

have access to a dedicated rest acility located

at the rear o the maintenance hangar. The

chie pilot believes that this allows his crew

to take naps, and is one o their most valuable

atigue countermeasures.

Supervsor and co-worer montorn

I your workers are at increased risk o a atigue-

related error, you may be able to ask peers or

supervisors to monitor atigue-related behaviours.

However, you need to guide people about what

to look out or. You must provide this inormation

in advance, to minimise misperceptions that

people are being watched.

You can make monitoring as simple as morerequent verbal contact (or example, regularly

throughout the shit), or you can make it

more ormal by mandating veried additional

supervisory checks (at hourly intervals

during night shit work, or example) or

saety-critical duties.


17/28


I you notice any o these symptoms, what

should you do?

Deal with the problem within your own team

rst by raising it (do not accuse) with the

person concerned. I notice you are looking

very tired; is everything OK?

Try to nd out why the person is atigued

Ask how you can help

I the problem continues, reach agreement

with the person that their supervisor should

be involved to allow or more ormal atigue

countermeasures

Emphasise that atigue is a saety-critical issue,

and work cannot continue until it is dealt with.

Tas rotaton and/or tas reallocaton

Task rotation has signicant potential as a atigue

control measure. In many cases, workload can

be made more engaging by varying the tasks

undertaken across a shit.

Task rotation can be more dicult in small

organisations with limited numbers o skilled

sta. However, where you have groups o skilled

sta, and particular rosters are known to be more

susceptible to atigue, or a saety-critical task is

under time pressure, a tag team approach to the

job can be useul. You might be able to alternate

sta between doing the job and quality control

cross-checking.

When atigue-related symptoms are recognised,

either by sel-assessment or supervisor

monitoring, consider task reallocation, especially

where there are high risks to the individual, to

peers, and/or to the general public.

For example, less risky tasks might be simpleprocedural tasks, word and data processing,

quality checks and basic communication. This

control only reduces exposure to high-impact

hazards, but does not mitigate the atigue itsel.

Mnmum accommodaton requrements forall overnht operatons

To ensure aircrew have the best opportunity

or good-quality sleep during overnight

operations, they require the ollowing minimum

accommodation:

A single room or each aircrew member,

which:

- has easy access to the worksite

- is air conditioned

- is comortable, clean and to a high

standard.

- has access to quality in-house meals.

I these minimum conditions are not met,

please inorm the chie pilot immediately.

Sutable overnht accommodaton and meals

I your organisation conducts overnight

operations, you may want to organise minimum

accommodation requirements with your

customers to ensure your sta have adequate

ood and rest acilities.

A small aircrat charter organisation has theollowing policy:

Strategic use of caeine

Caeine can provide a short-term improvement

in alertness. How intense and long lasting that

eect is depends on how much caeine the

body is used to, and how oten it is consumed.

Not surprisingly, the more requent and the

higher the caeine intake, the less noticeable

will be the improvement in alertness, so it should

only be used (with caution) as a contingency.

Reulator requrements

Two principal regimes require Australian aviation

operators to manage atigue: the various state

Occupational Health and Saety(OH&S) Acts

and CASA regulations.

The various Occupational Health and SaetyActs

adopt a generalised duty-o-care approach

employers must ensure that their workplaces are

as ree rom risk o harm as reasonably possible.

The broad ormulation o this duty covers the

risks posed by atigue.


18/28


Under CASA requirements, air transport

operators can choose to operate entirely under

prescriptive limits based on Civil Aviation Order

(CAO) Part 48 Flight Time Limitations; apply or

a standard industry exemption to CAO 48 and

operate under a atigue risk management system

(FRMS); or operate under a combination o both

(where some parts o the operation, one feet

or example, operate under an FRMS and the

rest do not). There is also relevant material or

maintenance organisations in Part 145.

SMS and FRMS compared

An FRMS is really a saety management

approach to dealing with the risks imposed by

atigue, so there are similarities between the

components o an SMS and FRMS, as shown

on the next page.

Fatue rs manaement sstem (FRMS)

Fatigue risk management systems are

increasingly being adopted by air transport

operators to control the risks o atigue-related

accidents and incidents. An FRMS is simply a

component o the overall saety management

system and includes controls such as:

Polc d procdurs documents how

atigue risk is managed and by whom

evluo d rvw measures program

eectiveness and recommends improvements

aud assesses operational compliance

with the atigue program policy, procedures

documents and ongoing legislative

requirements

Rcord p provides documented

evidence o atigue risk management

and is one element o an evaluation andreview process

educo d r trains individual

employees and stakeholders to manage

atigue risk competently

Commuco d cosulo

communicates and coordinates inormation

about atigue.

An eective atigue program requires multiple

atigue countermeasures or deences:

Provide sucient sleep opportunities to all

employees. Employees should take advantage

o these. Adopting prescriptive duty time

limitations and designing rosters to manage

atigue are other possible controls.

Ensure employees take responsibility or

obtaining sucient sleep, and report to you

i that has not been possible. Encourage

employees to report any atigue risk issues

through their direct supervisor, or by using a

more ormal saety occurrence report orm.

Train your employees to recognise their own

(and others), atigue-related behavioural

symptoms, and manage them appropriately.

Provide atigue management training

at induction, as well as ongoing atigue

management rereshers or employees,

contractors and stakeholders.

This ramework reduces the likelihood that an

individual will be exposed to atigue-related

risk. However, atigue-related risk cannot be

eliminated. Implement countermeasures such

as task rotation, task allocation, strategic use o

caeine, napping and co-worker/peer monitoringto reduce the risk o atigue-related errors.

Once a atigue-related incident has been

reported, carry out a thorough investigation

to identiy any additional risk controls or risk

management strategies required.

Busy liestyles, long commuting distances

and amily responsibilities can lead to atigue.

Thereore, it is important to acknowledge that

no one is immune to atigue. All sta and

contractors have a role to play in contributing

to managing and mitigating its potentially

hazardous eects.


19/28


toolkitSAFETy RiSk MANAgEMENT


20/28


ix ms

This is yoursaety toolkit with some best-practice

tips and practical tools that can be adapted

to meet your organisations needs. We hope

you nd them useul, whether you are urther

developing your SMS, starting an SMS rom

scratch, or simply looking or some ideas to

improve your existing SMS.

This list summarises the checklists/templates

you will nd at the back o each o the respective

booklets.

This is not an exhaustive list o resources.

There are many systems and products across

various industries, so this toolkit can only include

a very small sample o practices and/or tools

or inormation.

Inclusion o materials does not imply

endorsement or recommendation. Each

organisation must select the most appropriate

products or its individual and specic needs.

Boolet 1 Bascs

Jargon busters

Reerences

Boolet 2 - Safet polc and objectves tools

SMS organisation checklist

Saety policy statement

Saety managers job description

Role o the saety committee

SMS implementation plan

Ten steps to implementing an SMS

SMS gap analysis checklist

An eective emergency response

plan (ERP)

Language and layout o procedures/

documentation

Document register

Sample saety leadership rules

Aviation saety liesavers policy

Just culture procedure

Appendix A Workfow process or applying

the just culture procedures

Appendix B Bush Air counselling/discipline

decision chart

Boolet 3 - Safet rs manaement tools

error prvo srs or

orsos

Rs rsr

Smpl hzrd iD

gudc o job d s ds

a sx-sp mhod or volv s

s hzrd dfco

Hzrd rpor orm

Boolet 4 - Safet assurance tools

Generic issues to be considered when

monitoring and measuring saety perormance

Audit scope planner

Basic audit checklist

Inormation relevant to a saety investigation

Event notication and investigation report

Aviation saety incident investigation report

Corrective/preventative action plan

Checklist or assessing institutional resilience

against accidents (CAIR)

Practical saety culture improvement strategy

Saety culture index

Boolet 5 - Safet promoton tools

How to conduct a training needs analysis

Sample saety inormation bulletin on atigue

How to give a saety brieng/toolbox talk

Aviation saety toolbox talk

Saety brieng/toolbox meeting

attendance orm


21/28


e p sags gasas

Three strategies aimed at error prevention, which

is actually a orm o risk mitigation, are briefy

outlined below. These strategies are relevant

to fight operations, air trac control, or aircratmaintenance.

error rduco srs are intended to

intervene directly at the source o the error itsel,

by reducing or eliminating the contributing actors

to it. They seek improved task reliability by

eliminating any adverse conditions leading to an

increased risk o error. Error reduction is the most

requently used strategy.

Examples o error reduction strategies

include improving the access to a part or

maintenance, improving the lighting in which

the task is to be perormed and providing

better training.

error cpur assumes the error has already

been made. The intent is to capture the error

beore any adverse consequences o the error

are elt. Error capturing does not directly reduce

or eliminate the error.

Error capturing strategies include post-taskinspection, verication or testing, or example,

cross-checking a checklist. (However, a

possible drawback to this error prevention

strategy is that people may be less vigilant

when they know there is an extra deence in

place to capture their errors.)

error olrc reers to the ability o a system

to accept an error without serious consequence.

For example, as a strategy to prevent the loss o

both engines on an aircrat involved in extendedtwin-engine operations, some regulatory

authorities prohibit the same maintenance task

being perormed on both engines prior to a fight.

Examples o measures to increase error

tolerance are the incorporation o multiple

hydraulic or electrical systems on the aircrat,

and a structural inspection program allowing

multiple opportunities to detect a atigue crack

beore it reaches critical length.

gudance on error preventon/rsmtaton ssues to be consderedb oransatons

ICAO advocates some undamental strategies

aimed at error prevention, which is a orm o

risk mitigation. These include:

An open and transparent error-reporting

program (not one ocusing on culpability

and blame)

Human actors training provided with the

specic application o error identication,

capture and management

Non-jeopardy-based observational auditing

programs that examine the threat and error

management skills o saety-critical workers

The organisation advocating strict adherence

to standard operating procedures (SOPs)

and standard communication phraseology

Equipment design being human-centred

Systems to continually learn the lessons

o previous occurrences

Consideration given to using automation

where possible, particularly or routine

and monotonous tasks relying heavily onoperator vigilance.


22/28


rs gs

[sr m o orso] Rs rsr Lo umbr

The risk

What can happen?

How can this happen?

Existing

controls

The consequences o an

event happening

Additional

mitigation

required

Residual risk Action and

owners

Monitoring

and review

requirements

Date: xx/xx/xxxx Version: x Form SMS 3

Reportrefe

rence

number

Dateenteredin

register

Severity

Severity

Likelihood

Likelihood

Levelofris

k

Levelofris

k


23/28


Smpl hzrd iD

Hzrd iD Sh hdovr & u

Mitigators Eectiveness Reason Further controls/

deences required

Responsibility

Shit handover

procedures

No In a manual in

Bruces oce

nobody reads them

Hal-hour overlap

between shits to allow

or proper brieng,

and or log to be ully

completed

Cheryl Jones

Shit handover

log

No Not in central enough

place goes missing

To be transerred

to hangar PC, and

completed online

Cheryl Jones

Regular stasaety meetings

No Not held consistentlyenough

Schedule regularortnightly toolbox

meetings.

Trevor Brown(saety ocer)

Rostering No Not enough sta

to cover the

required shits

With planned growth,

take on new sta

Bruce Jones

Recording No Ad hoc system is only

done sometimes

Hazard & risk register

on hangar PC. Everyone

gives and receives

eedback

Trevor Brown &

Cheryl Jones


24/28


Ga jb aas sg

Job and task design can contribute to system

saety. Improving the design o jobs and tasks,

and the workspaces in which they are perormed,

can signicantly improve human perormanceand reduce the potential or human error.

Task design is essentially about matching the

person and the task - making sure that tasks and

activities are appropriate and suited to the human

operators or teams capabilities, limitations and

personal needs. For example, tasks that involve

excessive time pressure, complex sequences o

operations, reliance on memory, are physically

or mentally atiguing etc. are likely to have a

negative impact on perormance.

A typical approach may be to:

1. identiy saety-critical tasks, and those

who perorm them

2. design the task objectives, sequences and

actions to be perormed

3. structure the task so it supports the sae

perormance by the individual or team

4. consider the working environment so itsupports the sae perormance o the task

5. assess the potential risks associated

with non compliance, human capabilities

and limitations

6. implement risk management strategies

to manage identied risks

7. evaluate saety perormance against the

stated objectives.

Examples o design elements that can be

included are:

procedures and rules

equipment, tools and materials

human machine interace (HMI)

inormation requirements

manning and workload

workspace

capabilities and skills required

team structures

communication links

rostering

rewards and incentives

supervision.


25/28


A sx-sp mh involving sta in safetyhazard identication

To avoid accidents and incidents, any

organisation should have multiple layers

o controls or deences. However, controlsare never oolproo or example, having

well-trained maintenance engineers does

not ensure that aircrat components are

always tted correctly. Standard operating

procedures or fight crew are only as eective

as those who ollow them. Air transport

operators and maintenance organisations

should regularly identiy what deences they

have to contain recognised saety hazards as

an early warning saety system. To achieve this, six simple steps are

suggested:

1. Identiy saety hazards across your operations

that could harm people, equipment, property

or the environment.

2. Rank the likelihood and severity o these

hazards

3. Identiy the current deences/controls in place

to manage them

4. Evaluate the eectiveness o each

deence/control

5. Identiy additional deences/controls

where required

6. Record all this inormation in a

hazard register.

Ater completing these steps, you should have

the ollowing:

A list o saety hazards identied by

employees, ranked in order o importance

A list o current controls/deences in place

to manage these hazards

A list o urther controls/deences required

to improve saety across the operation

Sta involvement in identiying saety

deciencies and priority areas or improved

risk management.


26/28


Haza p m

Rpord b:

Name: __________________________________ Position: _________________________

Subjc:

[ ] Workplace hazard [ ] Hazardous work practice [ ] Public hazard [ ] Aviation saety hazard

Dscrpo o hzrd d co :

____________________________________________________________________________________________

____________________________________________________________________________________________

is urhr co rqurd? ys [ ] no [ ]

Rpord o:

Aviation saety ocer: _______________________________

Saety committee/rep: yes/no

Reporting persons name: ____________________________Signature: _______________________________

Date: ___________________________________

Suprvsor us ol

Date report received:__________________

Action taken or recommended:

____________________________________________________________________________________________

____________________________________________________________________________________________

Date implemented: ___________________

Name: ____________________________________________ Signature: _______________________________


27/28



28/28

www.asa.g.a131 757

safety-risk-management

Documents